# ProFTPD Configuration for WHP with MySQL Virtual Users
# This configuration provides secure FTP access with MySQL authentication
# and proper chroot jailing for hosting users

# Load required modules
LoadModule mod_sql.c
LoadModule mod_sql_mysql.c

# Basic Server Settings
ServerName                      "WHP ProFTPD Server"
ServerType                      standalone
DefaultServer                   on
Port                            21
Umask                           022
MaxInstances                    50
MaxClients                      50
MaxClientsPerHost               3

# User/Group Settings
User                            nobody
Group                           nobody

# Authentication Settings
AuthOrder                       mod_sql.c
AuthPAM                         off
AuthPAMConfig                   proftpd

# MySQL Authentication Configuration
RequireValidShell               off
SQLBackend                      mysql
SQLAuthTypes                    Plaintext
SQLAuthenticate                 users groups
SQLConnectInfo                  whp@127.0.0.1:3306 root $MYSQL_PASSWORD
SQLUserInfo                     ftp_users username password uid gid homedir shell
SQLGroupInfo                    ftp_groups groupname gid members
SQLLog                          PASS updatecount
SQLNamedQuery                   updatecount UPDATE "count=count+1, accessed=NOW() WHERE username='%u'" ftp_users
SQLLogFile                      /var/log/proftpd/sql.log

# Directory and Security Settings
DefaultRoot                     ~
RequireValidShell               off
DeferWelcome                    on
ShowSymlinks                    on
TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200
DisplayLogin                    welcome.msg
DisplayChdir                    .message
ListOptions                     "-l"
DenyFilter                      \*.*/

# Transfer Settings
AllowOverwrite                  on
AllowStoreRestart               on
AllowRetrieveRestart            on

# Logging
SystemLog                       /var/log/proftpd/system.log
TransferLog                     /var/log/proftpd/transfer.log
LogFormat                       default "%h %l %u %t \"%r\" %s %b"
LogFormat                       auth    "%v [%P] %h %t \"%r\" %s"

# Passive Mode Settings (for firewalls/NAT)
PassivePorts                    60000 60100
MasqueradeAddress               $PUBLIC_IP

# SSL/TLS Settings (optional)
<IfModule mod_tls.c>
    TLSEngine                   off
    TLSRequired                 off
    TLSRSACertificateFile       /etc/proftpd/ssl/proftpd.crt
    TLSRSACertificateKeyFile    /etc/proftpd/ssl/proftpd.key
    TLSVerifyClient             off
    TLSLog                      /var/log/proftpd/tls.log
    TLSProtocol                 TLSv1.2 TLSv1.3
</IfModule>

# SQL Quota Settings (optional)
<IfModule mod_quotatab_sql.c>
    QuotaEngine                 on
    QuotaDisplayUnits           Mb
    QuotaShowQuotas             on
    SQLNamedQuery               getquota SELECT "name, quota_type, per_session, limit_type, bytes_in_avail, bytes_out_avail, bytes_xfer_avail, files_in_avail, files_out_avail, files_xfer_avail FROM ftp_quotas WHERE name='%{0}' AND quota_type='%{1}'"
    SQLNamedQuery               getquotatally SELECT "name, quota_type, bytes_in_used, bytes_out_used, bytes_xfer_used, files_in_used, files_out_used, files_xfer_used FROM ftp_quotas WHERE name='%{0}' AND quota_type='%{1}'"
    SQLNamedQuery               updatequotatally UPDATE "bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2}, files_in_used = files_in_used + %{3}, files_out_used = files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name='%{6}' AND quota_type='%{7}'" ftp_quotas
    SQLNamedQuery               insertquotatally INSERT "%{0}, %{1}, %{2}, %{3}, %{4}, %{5}, %{6}, %{7}" ftp_quotas
    QuotaLimitTable             sql:/get-quota-limit/getquota/updatequotatally/insertquotatally
    QuotaTablesFile             sql:/get-quota-tally/getquotatally/updatequotatally/insertquotatally
</IfModule>

# Security restrictions
<Limit ALL>
    AllowUser                   OR anonuser
</Limit>

# Directory upload/download permissions
<Directory ~/*>
    <Limit WRITE>
        AllowUser               OR anonuser
    </Limit>
</Directory>

# Prevent access to sensitive files
<Directory ~/.*>
    <Limit ALL>
        DenyAll
    </Limit>
</Directory>

# Disable certain commands for security
<Limit SITE_CHMOD>
    DenyAll
</Limit> 